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DETAILED ACTION 
Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of 

the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 

the various claims was commonly owned at the time any inventions covered therein 

were made absent any evidence to the contrary. Applicant is advised of the obligation 

under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 

not commonly owned at the time a later invention was made in order for the examiner to 

consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 

prior art under 35 U.S.C. 103(a). 

2. Claims 1, 2, 3, 8, 9, 28, 29 and 35-37 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Mcintosh (U.S. Patent No. 6,185,576), Shisler et al (U.S. 
Patent Application No. 2001/0018708), and Schaefer et al. (U.S. Patent No. 5,826,268). 

3. Mcintosh rendered obvious independent claims 1 and 28 by the following: 
"...retrieving a data row..." at col. 39, lines 10-11. 

"...and associated security information..." at col. 33, lines 14-17. 
"...the data row having data..." at col. 39, lines 10-11. 
"...to be contained in the report..." at col. 27, line 50. 
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"...determining whether data in the data row..." at col. 39, lines 10-11. 

"...from the security information..." at col. 33, lines 14-17. 

"...if the data row ..." at col. 39, lines 10-11 . 

"...with a new page in the report..." at col. 28, lines 13-14. 

"...the data row..." at col. 39, lines 10-11. 

"...is placed on the new page..." at col. 28, lines 13-14. 

"...such that security is implemented..." at col. 33, lines 14-17. 

"...for the new page in the report..." at col. 28, lines 13-14. 

"...placing subsequent data rows..." at col. 39, lines 10-11. 

"...on pages..." at col. 28, lines 13-14. 

"...such that data..." at col. 39, lines 10-11. 

"...in the report is organized..." at col. 27, line 50. 

"...such that security is implemented..." at col. 33, lines 14-17. 

Mcintosh does not teach the use of data breaks, the use of data sources, and the 
use of security tags. 

4. However, Shisler teaches the determination of data breaks and the use of 
data sources as follows: 
"...from a data source..." at p. 4, par. 0074. 
"...will cause a data break..." at p. 8, par. 0112. 

"...that has been retrieved from the data source..." at p. 4, par. 0080 and p. 4, par. 0074. 
"...causes a data break..." at p. 8, par. 0112. 
"...at the page level..." at p. 4, par 0078. 



Application/Control Number: 09/450,813 Page 4 

Art Unit: 2177 

"...at the page level for the pages..." at p. 4, par 0078. 

It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to use data breaks in a report in order to start over at the top of a page 
whenever the classification changes for the items being listed. Likewise, it would have 
been obvious to one ordinarily skilled in the art at the time of the invention to use data 
sources to obtain classification information about the contents of information contained 
in these data sources in order to have a reliable source of this information. 

Shisler does not teach the use of security tags. 

5. However, Schaefer teaches the use of security tags as follows: 
"...forming a first security tag..." col. 8, lines 53-55. 

"...associating the first security tag..." col. 8, lines 53-55. 
"...having the first security tag associated therewith..." col. 8, lines 53-55. 
"...until a second security tag is formed..." col. 8, lines 53-55. 
"...based on a plurality of security tags..." col. 8, lines 53-55. 
"...associated with the plurality of security tags..." col. 8, lines 53-55. 

It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to use security tags in order to have a convenient method of marking data 
according to its security classification. 

6. As per claim 2, the "...report is generated from one executable 
component...," is taught by Shisler at par. 5. 

7. As per claims 3 and 29, the "...forming a first security tag...," is taught by 
Schaefer at col. 1 1 , lines 32-35, 
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the "...comprises retrieving a security identifier..." is taught by Schaefer at col. 4, lines 
25-27, 

the "...for each data break...," is taught by Shisler at p. 8, par. 0112, 

the "...from the data source...," is taught by Shisler at p.4, par. 0074, 

the "...wherein each data break...," is taught by Shisler at p. 8, par. 01 12, 

the "...is associated with one or more security identifiers...," is taught by Schaefer at col. 

4, lines 25-27, 

the "...combining the one or more security identifiers...," is taught by Schaefer at col. 4, 
lines 25-27, 

and the "...creating a first security tag...," is taught by Schaefer at col. 8, lines 53-55. 

8. As per claim 8, the "...sorting the data from the data source...," is taught by 
Shisler in Figure 21, 

the "...based on one or more data breaks...," is taught by Shisler at p. 8, par. 0112, 
the "...wherein a data break...," is taught by Shisler at p. 8, par. 01 12, 
and the "...is caused by a change in category of the data...," is taught by Shisler at p. 13, 
par. 0150. 

9. As per claim 9, the "...a data break..., is taught by Shisler at p. 8, par 01 12 
and the "...is a level break in the data...," is taught by Shisler in Figure 7. 

10. As per claim 35, the "...a data break is a level break in the data...," is 
taught by Shisler at p. 8, par. 01 12 and p. 3, par. 0071 . 

11. As per claim 36, the "...security information...," is taught by Mcintosh at 
col. 39, lines 14-17 
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and the "...comprises one or more database fields..., is taught by Mcintosh at col. 24, 
lines 35-39 and col. 22, lines 61-64. 

12. As per claim 37, the...," security information...," is taught by Mcintosh at 
col. 39, lines 14-17, 

and the "...comprises information indicating one or more levels of access to the data...," 
is taught by Mcintosh at col. 7, lines 38-42 and col. 21 , line 40. 

13. Claims 4, 5, and 30 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Mcintosh, Shisler, and Schaefer as applied to claims above, and 
further in view of Hellend et al. (U.S. Patent No. 6,014,666). 

As per claims 4 and 30, the "...from a security system...," is taught by Mcintosh at 
col. 19, lines 58-60, 

the "...with a data row...," is taught by Mcintosh at col. 39, lines 10-11, 

the "...mapping the one or more security identifiers...," is taught by Schaefer at col. 3, 

lines 60-65 and col. 8, lines 53-55, 

the "...in the first security tag...," is taught by Schaefer at col. 8, lines 53-55, 

the "...adopted from the security system...," is taught by Mcintosh at col. 19, lines 58-60, 

the "...creating a security tag adaptable...," is taught by Schaefer at col. 8, lines 53-55, 

the "...by the security system...," is taught by Mcintosh at col. 19, lines 58-60, 

the "...and associating the security tag...," is taught by Schaefer at col. 8, lines 53-55, 

the "...adaptable by the security system...," is taught by Mcintosh at col. 19, lines 58-60, 

the "...to a page in the report...," is taught by Mcintosh at col. 28, lines 13-14, 

but the "...associating a role adopted...," 



Application/Control Number: 09/450,813 Page 7 

Art Unit: 2177 

and the "...with one or more roles...," is not taught by either Mcintosh, Shisler, or 
Schaefer. 

However, Helland teaches the mapping of roles as follows: 

* . . . the installer maps the roles to the security configuration 
of the computer system on which the server application is 
installed, such as to specific user ids and groups..." at col. 
2, lines 59-61. 

It would have been obvious to one ordinarily skilled in the art at the time of the 

invention to associate roles with security identifiers in order to provide a convenient 

mechanism for relating specific users with specific information contained in the reports. 

14. As per claim 5, the "...security system...," is taught by Mcintosh at col. 19, 
lines 58-60, 

the "...has a plurality of roles...," is taught by Helland at col. 2, lines 59-61, 
and the "...a plurality of users.. .," is taught by Mcintosh at col. 28, lines 13-14. 

15. Claims 6 and 31 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Mcintosh, Shisler, Schaefer, and Hellend as applied to claims 4 and 
28 above respectively, and further in view of Asmuth et al. (U.S. Patent No. 5,272,767). 

As per claims 6 and 31 , the "...in the retrieved data row...," is taught by Mcintosh 
at col 39, lines 10-11, 

the "...upon which a data break is based...," is taught by Shisler at p. 8, par. 01 12, 
the "...in the security system...," is taught by Mcintosh at col. 19, lines 58-60, 
but the "...identifying a data column...," 

and the "...identifying one or more roles that... correspond to the data column...," are not 
taught by either Mcintosh, Shisler, Schaefer, or Hellend. 
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However, Asmuth teaches the association of roles with columns as follows: 

These two columns are associated with roles that the columns 
of input table 11 may play in the generation of output table 13 
as performed by the tool represented by icon 17..." at col. 3, 
lines 33-36. 

It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to associate roles with columns in order to provide flexibility in the use of the 
system. 

16. Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Mcintosh, Shisler, Schaefer, Hellend, and Asmuth as applied to claim 6 above, and 
further in view of Crapo (U.S. Patent No. 5,629,846). 

As per claim 7, the "...to map the one or more roles.. .with the data column...," is 
taught by Asmuth at col. 3, lines 33-36, 

the "...in the security system...," is taught by Schaefer at col. 19, lines 58-60, 

but the "...deriving translation rules...," is not taught by either Mcintosh, Shisler, 

Schaefer, Hellend, or Asmuth. 

However, Crapo teaches the use of translation rules for mapping as follows: 

*...The translation rules are used for mapping the entire source 
document to the target document../' at col. 2, lines 13-14. 

It would have been obvious to one ordinarily skilled in the art at the time of the 

invention to use translation rules to map the roles to columns in order to provide a 

systematic and consistent method of assigning roles to the columns. 

1 7. Claims 1 0 and 1 1 are rejected under 35 U.S.C, 1 03(a) as being 
unpatentable over Mcintosh, Shisler, and Schaefer as applied to claim 1 above, and 
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further in view of Lermuzeaux et al. (U.S. Patent No. 5,621 ,889) and Kenworthy (U.S. 
Patent No. 6,317,837). 

As per claim 10, the "...determining a first role in a security system that 
corresponds directly to the user...," 

the "...determining one or more secondary roles that correspond indirectly to the user...," 
the "...combining the first role with the one or more secondary roles...," 
and the "...creating a security clearance for the user...," are not taught by Mcintosh, 
Shisler, or Schaefer. 

However, Lermuzeaux teaches the use of a security system which uses roles 
associated with users as follows: 

*...The intrusion detection facility of the invention whose 
software architecture is shown in FIG. 1 is more particularly 
designed to be associated with a computer installation in the 
context of a security system designed to protect said computer 
installation from intrusions by users../' at col. 3, lines 13- 
17. 

*...The mission analyzer referenced 120 is defined to verify 
that the tasks which are current for a user under consideration 
in the computer installation 1 correspond to the missions 
specified by the roles specific to that user../' at col. 10, 
lines 19-22. 



It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to determine roles that correspond to users in order to establish a systematic 
and convenient means of defining which users will have access to specific data, 

Lermuzeaux does not teach the use of security clearances. 

However, Kenworthy teaches the use of security clearances as follows: 
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*...it may be desirable to establish varying levels of security 
clearance, such that only certain authorized users of the LAN 
are permitted to 1 access a particular NAD server. . /' at col, 1, 
lines 52-54. 

It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to use security clearances in order to further define a systematic and 
convenient means of defining which users will have access to specific data. 

18. As per claim 1 1, the "...comparing the security clearance...," is taught by 
Kenworthy at col. 1 , lines 52-54, 

the "...for the user...," is taught by Mcintosh at col. 21, lines 62-65, 

the "...with one or more of the plurality of security tags...," is taught by Schaefer at col. 8, 

lines 53-55, 

and the "...to derive a subset of pages in the report that can be viewed by the user...," is 
taught by Mcintosh at col. 5, 43-46 and col. 28, lines 13-14. 

Allowable Subject Matter 

1 9. The following is a statement of reasons for the indication of allowable 
subject matter: The Examiner finds Applicants 1 arguments on pages 12-13 of the 
"Amendment B" filed 15 September 2003 concerning a method of viewing a report 
having a security tag associated with pages in the report such that a user can only view 
data authorized to be shown to the user persuasive as applied to independent claims 12 
and 32. The combinations of prior art from Mcintosh (U.S. Patent No. 6,185,576), 
Schaefer et al. (U.S. Patent No. 5,826,268), and Jebens (U.S. Patent No. 6,332,146) 
neither render obvious nor anticipate the combination of recited elements in light of 
claims 12 and 32. In particular, the combination of Mcintosh, Schaefer, and Jebens 
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does not render obvious the phrase "renumbering pages in the subset of pages such 
that the subset of pages are renumbered consecutively such that the report presented 
to the user appears to be complete without indicating that one or more of the superset 
of pages of the report are not presented to the user." 

20. The Examiner finds Applicants' arguments on pages 1 2-1 3 of the 
"Amendment B" filed 15 September 2003 concerning a method of viewing a report 
having a security tag associated with pages in the report such that a user can only view 
data authorized to be shown to the user persuasive as applied to independent claim 14. 
The combinations of prior art from Mcintosh (U.S. Patent No. 6,185,576), Schaefer et al. 
(U.S. Patent No. 5,826,268), and Jebens (U.S. Patent No. 6,332,146) neither render 
obvious nor anticipate the combination of recited elements in light of claim 14. In 
particular, the combination of Mcintosh, Schaefer, and Jebens does not render obvious 
the phrase "the first page in the subset is page one and the subsequent pages are 
renumbered consecutively such that the report presented to the user appears to be 
complete without indicating that one or more of the superset of pages of the report are 
not presented to the user." 

Response to Arguments 

21 . Applicants' arguments filed 1 5 September 2003 have been fully 

considered but they are not persuasive. In the first argument for independent claims 1 

and 28 on page 11, paragraph 3, the Applicants state: 

"As the Examiner recognizes, Mcintosh does not teach or suggest the use 

the use of security tags in the manner claimed. For instance, Mcintosh neither discloses 

nor suggests "retrieving a data row and associated security information from a 

data source the data row having data to be contained in the report," "forming a first 
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security tag from the security information that has been retrieved from the data source if 
the data row causes a data break," "associating the first security tag with a new page in 
the report wherein the data row is placed on the new page such that security is 
implemented at the page level for the new page in the report," or "placing subsequent 
data rows on pages having the first security tag associated therewith until a second 
security tag is formed such that data in the report is organized based on a plurality of 
security tags such that security is implemented at the page level for the pages 
associated with the plurality of security tags," as recited in claim 1, as amended." 

A combination of Mcintosh and Shisler references teaches "retrieving a data row and 

associated security information from a data source the data row having data to be 

contained in the report" as follows: Mcintosh teaches "retrieving a data row" at col. 39, 

lines 10-11, "and associated security information" at col. 33, lines 14-17, "the data row 

having data" at col. 39, lines 10-11, and "to be contained in the report" at col. 27, line 50 

and Shisler teaches "from a data source" at p. 4, par. 0074. A combination of Mcintosh, 

Shisler, and Schaefer references teaches "forming a first security tag from the security 

information that has been retrieved from the data source if the data row causes a data 

break" as follows: Mcintosh teaches "from the security information" at col. 33, lines 14-17 

and "if the data row" at col. 39, lines 10-11, Shisler teaches "that has been retrieved 

from the data source" at p. 4, par. 0080 and p. 4, par. 0074 and "causes a data break" 

at p. 8, par. 01 12, and Schaefer teaches "forming a first security tag" col. 8, lines 53-55. 

A combination of Mcintosh, Shisler, and Schaefer references teaches "associating the 

first security tag with a new page in the report wherein the data row is placed on the 

new page such that security is implemented at the page level for the new page in the 

report" as follows: Mcintosh teaches "with a new page in the report" at col. 28, lines 13- 

14, "the data row" at col. 39, lines 10-11, "is placed on the new page" at col. 28, lines 

13-14, "such that security is implemented" at col. 33, lines 14-17, and "for the new page 
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in the report" at col. 28, lines 13-14, Shisler teaches "at the page level" at p. 4, par 0078, 
and Schaefer teaches "associating the first security tag" col. 8, lines 53-55. A 
combination of Mcintosh, Shisler, and Schaefer references teaches "placing subsequent 
data rows on pages having the first security tag associated therewith until a second 
security tag is formed such that data in the report is organized based on a plurality of 
security tags such that security is implemented at the page level for the pages 
associated with the plurality of security tags" as follows: Mcintosh teaches "placing 
subsequent data rows" at col. 39, lines 10-11, "on pages" at col. 28, lines 13-14, "such 
that data" at col. 39, lines 10-11, "in the report is organized" at col. 27, line 50, and 
"such that security is implemented" at col. 33, lines 14-17, Shisler teaches "at the page 
level for the pages" at p. 4, par 0078, and Schaefer teaches "having the first security tag 
associated therewith" col. 8, lines 53-55, "until a second security tag is formed" col. 8, 
lines 53-55, "based on a plurality of security tags" col. 8, lines 53-55, and "associated 
with the plurality of security tags" col. 8, lines 53-55. 

22. In the second argument for claims 10 and 11 on page 12, paragraph 4 and 
page 13, paragraph 1, the Applicants state: 

"The cited references, separately or in combination, neither disclose nor suggest 
associating a security tag with a new page in a report wherein the data row is placed on 
the new page. Moreover, the cited references, separately or in combination, 
fail to disclose or suggest placing subsequent data rows on pages having the first data 
tag until a second security tag is formed such that data in the report is organized based 
on a plurality of security tags. Similarly, the cited references fail to disclose or suggest 
comparing security information associated with a user with such security tags in order to 
ascertain which pages of a report are viewable by the user (e.g., claims 10 and 11)." 

A combination of Mcintosh and Schaefer references teaches "placing subsequent data 

rows on pages having the first security tag associated therewith until a second security 
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tag is formed such that data in the report is organized based on a plurality of security 
tags" as follows: Mcintosh teaches "placing subsequent data rows" at col. 39, lines 10- 
1 1 , "on pages" at col. 28, lines 13-14, "such that data" at col. 39, lines 10-11, and "in the 
report is organized" at col. 27, line 50 and Schaefer teaches "having the first security tag 
associated therewith" col. 8, lines 53-55, "until a second security tag is formed" col. 8, 
lines 53-55, and "based on a plurality of security tags" col. 8, lines 53-55. A combination 
of Mcintosh, Schaefer, Kenworthy references teaches "comparing security information 
associated with a user with such security tags in order to ascertain which pages of a 
report are viewable by the user", which has been rephrased from claim 1 1 as follows: 
Mcintosh teaches "for the user" at col. 21 , lines 62-65 and "to derive a subset of pages 
in the report that can be viewed by the user" at col. 5, 43-46 and col. 28, lines 13-14, 
Schaefer teaches "with one or more of the plurality of security tags" at col. 8, lines 53- 
55, and Kenworthy teaches "comparing the security clearance" at col. 1 , lines 52-54. 

23. In the third argument for independent claims 1 and 28 on page 13, 
paragraph 2, the Applicants state: 

"Since the cited references together fail to disclose each of the claimed elements, the 
combination of these references also fails to disclose or suggest the claimed invention. 
Moreover, since the cited references together fail to disclose each of the claimed 
elements, the combination of the references would fail to achieve the desired result. 
In addition, it is important to note that there is no motivation to combine the above-cited 
references." 

The motivation to combine Mcintosh and Shisler as shown in section 4 states: 

"It would have been obvious to one ordinarily skilled in the art at the time of the 
invention to use data breaks in a report in order to start over at the top of a page 
whenever the classification changes for the items being listed. Likewise, it would have 
been obvious to one ordinarily skilled in the art at the time of the invention to use data 
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sources to obtain classification information about the contents of information contained 
in these data sources in order to have a reliable source of this information." 

Likewise, the motivation to combine Schaefer with Mcintosh and Shisler as shown in 
section 5 states: 

It would have been obvious to one ordinarily skilled in the art at the time of the invention 
to use security tags in order to have a convenient method of marking data according to 
its security classification. 

It is clear that motivations have been provided for combining Mcintosh, Shisler, and 
Schaefer. 

24. In the fourth argument for the dependent claims 1 and 28 on page 13, 
paragraph 3, the Applicants state: 

"The dependent claims depend from one of independent claims 1,12, 28, and 32 and 
are therefore patentable for at least the same reasons. However, the dependent claims 
recite additional limitations that further distinguish them from the cited references. 
Hence, it is submitted that the dependent claims are patentable over the cited art." 

The responses to the first and third arguments have shown that independent claims 1 

and 28 are still rendered obvious. For this reason all dependent claims, which depend 

on independent claims 1 and 28 are also rendered obvious. Independent claims 12 and 

32 have been allowed. All dependent claims dependent on claims 12 and 32 and the 

newly amended independent claim 16 are therefore also allowed. 

Conclusion, 

25. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1 .136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

26. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Harold E. Dodds, Jr. whose telephone number is 
(703)-305-1 802. The examiner can normally be reached on Monday - Friday 8:00 - 
4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John E. Breene can be reached on (703)-305-9790. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



Harold E. Dodds, Jr. 
Patent Examiner 
May 14, 2004 
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